Everyone has someone they report to, and for the OIG, one of those bosses is the U.S. Congress. Twice a year, the OIG submits a report to “the boss”, summarizing some of their significant activities and tooting their own horn, so to speak.  

OIG Reveals Impressive Return in Expected Recoveries and Receivables 

In a recent report, the OIG announced a $12.70 return in expected recoveries and receivables for every $1 invested, an ROI any of us would love to have.

For the most recent six-month period, OIG also reported substantial financial and enforcement activity to Congress.

Report Reveals Advance Insights into OIG Game Plan

The report also provides insight into areas OIG may plan to target. These four areas are especially worth watching for compliance professionals.

1. Criminal and Civil Enforcement Highlights 

OIG highlighted many cases, but a couple are especially likely to catch compliance professionals’ attention: 

Wound Graft False Claims Fraud Results in Prison, Restitution and Settlement 

The owners of several wound graft companies were sentenced to prison, ordered to pay restitution, and agreed to pay a settlement to resolve False Claims Act liabilities. OIG reported that these individuals ran a nationwide scheme targeting Medicare patients that resulted in orders for medically unnecessary, oversized skin grafts. They also accepted millions of dollars in illegal kickbacks and directed nurse practitioners to apply unwarranted grafts, resulting in more than $1.2 billion in fraudulent claims submitted to Federal health care programs.  

Convicted Physician Excluded from Federal Health Programs for 50 Years 

A rheumatologist was excluded from participating in Federal health care programs for 50 years after being convicted of health care fraud involving more than $118 million in false claims. Specifically, the OIG reported that the doctor falsely diagnosed patients with chronic illnesses to bill for tests and treatments that were medically unnecessary. These false diagnoses led patients to receive unnecessary treatments, including injections, infusions and X-rays.  

2. OIG Financial Integrity Efforts Target Improper Payments 

Knowing the possible OIG focus areas helps compliance professionals when they are performing risk assessments, auditing and monitoring. You can get a sense of where OIG is looking and where you might need to assess and prepare.  

Relating to financial integrity, the OIG highlighted areas of their work designed to prevent and detect improper payments. Noteworthy examples included: 

Autism Services 

OIG determined that two states (Maine and Colorado) made improper Medicaid payments for applied behavior analysis (APA), which is a behavioral therapy often used to help individuals with autism.  

Maine made an estimated $45.6 million ($28.7 million Federal share) in improper payments and an estimated $22.4 million ($14.2 million Federal share) in potentially improper payments. Colorado made an estimated $77.8 million ($42.6 million Federal share) in improper payments and an estimated $207.4 million ($112.5 million Federal share) in potentially improper payments.  

Durable Medical Equipment (DME) 

OIG looked at payments for a 7-year period for durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) that were provided during inpatient stays. They found that $22.7 million in Medicare payments to suppliers should not have been paid.  

The overpayments were a result of system edits to CMS’s claims processing system for Medicare Parts A and B that were not working properly to prevent or detect such overpayments.   

Managed Care Enforcement 

OIG continues to emphasize concerns with potential overpayments in Medicare Managed Care. In addition to their publishing the Industry Segment-Specific Compliance Program Guidance for Medicare Advantage, they also highlighted two large settlements. 

The first was a $556 million settlement with five Kaiser Permanente affiliates to resolve False Claims Act allegations that they systematically submitted invalid diagnosis codes for Medicare Advantage enrollees to receive inflated payments.   

The second settlement was with Aetna, which agreed to pay $117.7 million to resolve allegations under the False Claims Act that it submitted, or failed to retract inaccurate Medicare Advantage diagnosis codes to inflate payments from CMS. The insurer certified and maintained false and unsupported patient diagnoses, including for morbid obesity and chart review coding, resulting in overpayments.  

3. Patient Safety Gets Continued Emphasis in OIG Plan 

Compliance professionals know that over recent years, the OIG has emphasized patient safety in much of their guidance. In their report to Congress, OIG again highlights activities around protecting people from harm.  

Examples 

• A physician in Michigan who was excluded from participating in Federal health care programs for 60 years based on convictions of criminal sexual misconduct. 
• Work overseeing improper use of antipsychotic medications in nursing homes. 
• 64% of nursing homes received a serious deficiency within three years of graduating from the CMS Special Focus Facility program, which is supposed to address quality problems at the poorest performing nursing homes with track records of serious noncompliance.  
• Nursing home owners in New Jersey were excluded from Federal health care programs for cost-cutting activity that resulted in facility residents being neglected, abused, receiving inadequate medical care and residing in unsanitary conditions. 
• A nursing facility CEO was sentenced to prison for diverting funds for personal enrichment when those funds were intended for resident care. With the resulting lack of funds for care, the facility was understaffed and unsafe. 

4. Integrity of Grants and Contracts Puts Millions at Risk 

HHS offers a significant number of grants and enters into many contracts, and OIG is looking at compliance with requirements associated with grants and contracts.  

Examples 

• Compliance With Federal Contracting Requirements–Administration for Children and Families (ACF) 
• Gaps in National Institutes of Health (NIH) oversight put millions in funding for “Other Transactions” at greater risk of fraud, waste or abuse. 
• A cancer institute agreed to pay $15 million to settle False Claims Act allegations that it caused the submission of false claims to NIH related to scientific grants. The institute admitted that between 2014 and 2024, it used NIH funding to support cancer research publications containing misrepresented, duplicated, rotated, magnified or stretched images, often depicting different experimental conditions or timepoints across 14 journal articles tied to six NIH grants.  

Compliance Leaders Can Find Clues in OIG Plan 

As you assess your organization’s compliance risks, look for clues in these four areas and others included in the OIG plan submitted to Congress. With their impressive return on investment, the OIG is likely to continue to receive the resources they need to prevent, detect and enforce compliance, and their plan likely shares some of their roadmap. 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 22 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Where Does the Recent OIG Plan Focus? Highlights of Note  first appeared on YouCompli.

New compliance professionals benefit from a variety of resources to ramp up their knowledge and value. If you’re new to the healthcare compliance field (or know someone who is), save and share this article 

Getting Started for Early-Career Compliance Professionals 

The 20+ foundational resources that follow were curated from the YouCompli resource library. This set is tailored specifically for early-career compliance professionals. Start reading for ideas to build your: 

• Leadership skills 
• Operational credibility 
• Cross-departmental influence 

Read Expert-Sourced Content Designed for Professional Development 

Written for (and sometimes directly by) healthcare compliance executives, the information is practical and easy to understand. 

The articles focus on a variety of important topics: 

• Communication and Professional Growth for New Leaders 
• Operational and Audit Fundamentals for Building Compliance Expertise 
• Technology and Strategic Planning for Regulatory Change Management 
• Compliance Program Building and Oversight 
• Video Hub: Expert Guidance for Healthcare Compliance Professionals 
• Downloadable Tip Sheets for Quick Ideas and Actions 
   

Pick where you need help most today and dive in. (A few resources fall into multiple categories, so you get double the return when you read them.) 

Communication and Professional Growth for New Leaders 

From soft skills to dollar signs, these articles cover areas that sometimes get neglected in more formal compliance leader training. These expert resources cover aspects of compliance communications you might not find anywhere else. Learn about the persuasive communication skills that are the secret superpowers behind strong compliance leaders.  

Aggressive vs Assertive Communication: What New Healthcare Compliance Officers Need to Know  

Get advice tailored for new leaders on building authority and articulating compliance risks without creating unnecessary friction. New compliance executive can learn how to speak with authority and assertiveness without damaging cross-departmental relationships.  

This article covers:  

• Key differences between two common communication styles  
• How assertive communication benefits the compliance program  
• Strategies to help you master this skillset 

Integrate Self-Awareness into Healthcare Compliance Programs: 18 Tips  

Being aware of how we do our own work is paramount for an effective compliance program and incorporating self-awareness into your healthcare compliance program can enhance its effectiveness. For example, it improves your ability to empathize with the challenges operational leaders face when adjusting a process to meet a regulatory requirement. To help build awareness, explore these 18 actionable tips for compliance officers. 

Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  

For effective healthcare compliance leaders, financial literacy isn’t optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  Explains key financial concepts so business newcomers can align compliance goals with executives’ organizational priorities.  

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.   

Operational and Audit Fundamentals for Building Compliance Expertise 

Business operations are essential partners in a good compliance program, and audits are foundational to healthcare compliance in those areas. These resources drill down into both, explaining how to reduce friction and frustration through proactive partnerships and education.  

Audit Readiness? How about Audit Etiquette?  

In this blog, experts offer the real scoop on audit readiness in healthcare. It outlines crucial operational protocols and relationship dynamics for leading teams through smooth, defensible audits. Learn the unfiltered truth about compliance audits and what audit etiquette means. Get essential tips on: 

• Preparing for audits 
• Role of healthcare compliance auditors 
• What to do (and what not do) during an audit 
• What does audit readiness mean? 

Healthcare Quality Leadership: How to Be an Operational Partner, Not a Roadblock  

In every organization, there’s a moment where the quality department becomes either the trusted operational partner or the operational roadblock. The difference between the two comes from how you communicate, assign responsibility and how you follow through. This blog explains how to adopt the OG style for more effective quality programs in healthcare, with “Three Ways to Partner like a Pro.” Direct the strategies that shift compliance from a gatekeeper to a strategic business enabler. 

Three Tips for Strong Compliance Education Practices  

Compliance orientation educates new staff members about company policies, procedures, and various regulations that govern their specific roles. Ongoing compliance training ensures that as regulations evolve, all employees are appropriately educated on implications and requirements. With its emphasis on risk management, compliance training protects both employees and organizations from legal and ethical pitfalls.  

A good understanding of compliance helps employees safeguard the company against lawsuits and reputational damage. Get core principles and three tips for clear, memorable staff training programs that drive actual behavioral change. Two experts – one in education and one in compliance – share advice and analogies to improve your compliance education practices.    

Technology and Strategic Planning for Regulatory Change Management 

Technology and strategy have a lot in common. We expect both to be versatile and responsive, while at the same time, they have to hold up and carry the organization over the long term. These selections explore ideas that will help novice leaders leverage technology to drive strategy and value.  

What to Look for in Regulatory Change Management Software for Healthcare Compliance 

The ROI of tools like the YouCompli Analytics Dashboard comes from actionable, on-demand information to reduce the risk of noncompliance, fines, and reputational damage. Further value comes from efficient, centralized documentation, dashboard details and insights into completed work. Get a practical checklist to help new leaders evaluate software capabilities for tool selection. Learn six non-negotiables for regulatory change management software and processes. 

AI Guide for Healthcare Compliance Leaders  

From Manual to Scalable: How to Manage Healthcare Compliance Risk 

Despite recognizing it as a top risk year after year, many organizations still manage regulatory change as a monitoring activity. Updates are tracked. Summaries are circulated.  But when change actually occurs, the organization is left to work out (often manually and inconsistently) what the change means and what to do next.  

From a systems-thinking perspective, this is a structural failure, not an execution problem.  In this piece, Lisa Estrada explores systems-thinking strategies to move beyond manual processes and build a scalable regulatory compliance process.  

Compliance Program Building and Oversight 

During your compliance career, you may have opportunities to build a program or at least manage one. Using the metrics and collaboration-building practices covered in these resources will set you on the path. 

5 Strategies for Compliance Accountability Across the Organization  

While supporting operational teams in finding compliant solutions is part of your role, becoming the de facto fixer of what constitutes “operationally friendly” is beyond your scope. That piece must be owned by operations.  The challenge becomes how to get operational leaders to take ownership to resolve their own compliance challenges. 

These five strategies will help you encourage your operational leaders to take responsibility for their particular compliance issues, while preserving your role as a trusted advisor. Respected compliance professional Jay Anstine outlines methods for instilling shared ownership of compliance requirements across clinical and administrative business units.  

Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track? 

How Slowing Down Makes for a More Productive Compliance Program  

As regulations change or investigations are needed, we often get pushed to work faster, meet tighter deadlines, and juggle multiple tasks simultaneously.  

While this approach might seem efficient on the surface, it often leads to serious downsides: 

• Burnout 
• Decreased productivity 
• Decline in the quality of work  

This interesting piece focuses on transitioning from reactive firefighting to building deliberate, repeatable compliance processes. You’ll get five solid tips to help you and your compliance team slow things down in a good way. 

Video Hub: Expert Guidance for Healthcare Compliance Professionals 

While we can’t go into all of them here, the YouCompli video library is packed with useful visual learning materials.  Explore the full catalog, featuring expert interviews and practical strategies. 

Real Conversations. Practical Compliance Insights. 

Where do you need ideas and advice? 

• Compliance Leadership & Mindset 
• Influence, Trust & Seat at the Table 
• Operationalizing Compliance  
• Efficiency, Clarity & Saving Time 
• Customer Perspectives & Real‑World Experience 

Hear directly from compliance leaders who understand the realities of the work. These short videos share honest perspectives on simplifying regulatory requirements, building trust with the business, and turning compliance into a strategic advantage. 

Downloadable Tip Sheets for Quick Ideas and Actions 

For the compliance leader on the go (isn’t that all of us?) the Tip Sheet Library offers quick, useful information. Explore the collection and start downloading tip sheets to start your own handy idea file. 

• Compliance Career Tips 
• Compliance Culture 
• Compliance & Business Strategy 
• Healthcare Quality 
• Industry Trends 
• Rev Cycle 
• Rules and Regulations 

Need More Specialized Support for Your Healthcare Compliance Program? 

Not only does YouCompli have educational resources to help compliance professionals, we also human resources who can help. If you’d like to speak to someone to answer any questions, just reach out. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post Resources to Accelerate New Healthcare Compliance Careers  first appeared on YouCompli.

A compliance control can exist, be documented and even be automated, yet still fail to prevent or detect a problem. That distinction matters as healthcare organizations add more policies, system edits, review procedures and reporting tools. The purpose of regulatory compliance control is to mitigate risk across the different operations and workflows in healthcare delivery.  

The presence of a control may give a false sense of security.  

The presence of a control may demonstrate that an organization recognized a risk. It doesn’t necessarily prove that the risk is being managed consistently. 

A recent audit from the U.S. Department of Health and Human Services Office of Inspector General offers a practical example of where controls can go wrong. 

What the OIG Audit Found 

The audit reviewed certain Medicare Part B payments made by Wisconsin Physicians Service (WPS) Insurance Corporation, a Medicare administrative contractor, for outpatient services during 2022 and 2023. 

Of 801 selected claim lines, OIG found that: 

• 138 claim lines were incorrect, resulting in at least $140,182 in overpayments. 
• 31 additional claim lines totaling $76,640 didn’t have supporting documentation. 
• Providers attributed identified overpayments to clerical errors and issues with their billing systems. 
• WPS had system edits in place but edits and review of flagged payments didn’t consistently identify claim lines that were in error. 

OIG recommended recovering identified overpayments and locating additional medical record documentation. Other recommendations included enhancing existing system edits and review processes and improving provider education. WPS agreed with all five recommendations. 

Read the official HHS-OIG audit summary and access the full report. 

Why Established Compliance Controls Still Fail 

Even though the audit focused on a specific contractor and set of Medicare payments, its findings illustrate a broader operational issue for healthcare compliance leaders: 

Having a control isn’t the same as knowing the control works. 

Most healthcare organizations don’t lack policies, procedures or controls. In fact, it may seem like there’s an abundance of those to some people.  

The more common challenge is that those controls operate across different people, departments and systems, and workflow can break down. A billing edit may identify a claim, but someone still needs to review it. A policy may require supporting documentation, but someone must still locate that documentation when it’s requested. An error may be corrected, but the organization still needs to verify the correction occurred. 

Each handoff creates an opportunity for the process to break down. 

Four Reasons for Control Failure 

As discussed in From Manual to Scalable: How to Manage Healthcare Compliance Risk, regulatory and compliance work becomes its own source of risk when it depends on individual effort, institutional memory and disconnected systems.  

In this environment, controls commonly fail for four reasons. 

1. The Process Depends on Manual Perfection 

Many compliance processes still rely on someone remembering to complete a step, notice an exception or follow up with another department. 

Manual work isn’t inherently ineffective. Human judgment is still essential to compliance. The problem arises when the process relies on individual memory without a reliable structure around it. 

Consider how often an organization depends on someone to: 

• Recognize that an issue requires review 
• Send an email to the appropriate person 
• Remember to follow up 
• Save supporting documentation 
• Confirm that the issue was corrected 
• Preserve evidence of the completed response 

A capable employee may perform those steps correctly most of the time. But a mature compliance program shouldn’t depend on perfect execution every time. The odds are against that long term. 

Instead, every regulatory change process should make the required next step clear, assign responsibility and show when work remains incomplete. 

2. A System Flag Is Mistaken for a Completed Control 

There are many reasons a system may successfully flag a potential error while the broader control still fails: 

• The alert goes to the wrong person. 
• No deadline is attached to the review. 
• The reviewer lacks sufficient context. 
• The alert is dismissed without documenting why. 
• The issue is corrected but not verified. 
• No one evaluates whether similar errors may exist elsewhere. 

This is the difference between detection and resolution. 

Automated edits and alerts can strengthen a compliance process, but an alert is only the beginning. 

A system edit can detect a possible problem. It can’t by itself ensure someone in the organization:  

• Evaluates the issue  
• Decides what action is required  
• Completes that action  
• Preserves evidence of the response 

Look at the full process surrounding an automated control, not just whether the technology generates an alert. 

3. Documentation Exists but Can’t Be Retrieved 

Supporting documentation is a recurring issue in audits, investigations and internal reviews. Sometimes the underlying work was completed, but the organization can’t produce any evidence.  

The organization may believe the record exists without actually knowing who owns it or where it can be found. Documentation could be stored in an individual inbox, a shared drive, a clinical system, a billing platform or a department-specific folder.  

For compliance purposes, documentation that can’t be retrieved may provide little practical protection. 

What Helpful Documentation Should Look Like 

A defensible process should make it possible to determine: 

• What happened 
• Who reviewed the issue 
• What information was considered 
• What decision was made 
• Why that decision was reasonable 
• What corrective action was assigned 
• Whether the action was completed 
• Where the supporting evidence is stored 

The goal isn’t about creating documentation for its own sake. The goal is to preserve a clear, trustworthy account of how the organization responded. 

For a deeper look at this issue, read How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof. 

4. Ownership Ends at the First Handoff 

Compliance teams rarely perform every operational task required to address a risk. They may identify the issue and send it to Revenue Cycle, Coding, Clinical Operations, Privacy, Legal, Quality or another department. Those handoffs are necessary, but they don’t complete the compliance process. 

Someone must remain responsible for determining whether the requested work was completed and whether the result adequately addressed the original risk. 

Without that accountability, a process becomes a series of disconnected activities: 

1. Compliance identifies a concern. 
2. The issue is sent to another department. 
3. The department begins reviewing it. 
4. A correction may or may not occur. 
5. The outcome is never reported back. 
6. Compliance can’t confirm completion or produce evidence later. 

Activity occurred, but the organization can’t demonstrate resolution. That’s why clear ownership means defining responsibility for both the operational action and the final verification. 

Three Questions to Test Whether a Control Works 

Healthcare compliance leaders can use three practical questions to evaluate a control. 

1. Does the Control Reliably Detect Exceptions? 

Don’t just ask whether a policy, edit or review procedure exists. 

Every time, the compliance leader should ask: 

• What specific risk is the control designed to identify? 
• What information does it evaluate? 
• Are there circumstances it may miss? 
• How often is its effectiveness tested? 
• What happens when the control identifies a potential exception? 

A control should have a clearly defined purpose and recognized limitations. It’s another job for compliance.  

2. Can We Retrieve the Supporting Evidence? 

Select a completed compliance action and attempt to reconstruct it. 

Can your organization quickly show: 

• Original issue or requirement 
• Analysis that occurred 
• People involved 
• Decision and rationale 
• Actions assigned 
• Completion records 
• Final verification 

This is a useful test because it evaluates the process from the perspective of an auditor, regulator or new compliance leader who wasn’t involved in the original work. 

3. Who Owns Correction and Verification? 

The person completing the corrective action may not be the person responsible for verifying it. Both roles should be clear. 

For example, an operational department may correct a billing process, while Compliance verifies that the correction addresses the identified concern and that evidence has been preserved. 

Without defined ownership, issues can remain open even after everyone believes someone else completed the work. 

From Individual Controls to Regulatory Operationalization 

The broader challenge isn’t simply building more controls but connecting them to repeatable operational processes. 

Then, when an issue or regulatory requirement is identified, the organization should be ready to: 

1. Assess its relevance and potential impact. 
2. Determine which departments and processes are affected. 
3. Define the required operational response. 
4. Assign clear owners and deadlines. 
5. Communicate expectations to the people completing the work. 
6. Track implementation and escalation. 
7. Verify that the required action occurred. 
8. Preserve documentation of the organization’s response. 

YouCompli refers to this discipline as Regulatory Operationalization: turning regulatory change into assigned, completed, verified and defensible action. This isn’t a one-off fix, but a scalable solution that adapts to health system needs. 

Technology can support this process but shouldn’t replace human judgment. The strongest approach combines structured workflows and automation with knowledgeable human review. 

Organizations evaluating whether their current technology supports that full process can use the six capabilities outlined in What to Look for in Regulatory Change Management Software for Healthcare Compliance. 

Metrics That Show Whether Controls Are Working 

Executive leadership and the Board of Directors may already receive compliance reports showing how many reviews, audits or corrective actions occurred. 

Those activity metrics are useful, but don’t necessarily demonstrate control effectiveness. 

Compliance leaders should also consider measures such as: 

• Percentage of flagged exceptions reviewed by the deadline 
• Average time from detection to resolution 
• Number of overdue corrective actions 
• Percentage of completed actions with supporting evidence 
• Recurrence rate of previously identified issues 
• Number of controls tested for effectiveness 
• Percentage of corrective actions independently verified 
• Time required to retrieve audit-ready documentation 

These measures help move the conversation from “Do we have a control?” to “Can we demonstrate that the control works?” 

For additional guidance on choosing useful measures and communicating them effectively, read Beyond the Penalty: What Metrics Should Healthcare Compliance Officers Track?. 

Compliance reporting should also help leaders identify overdue work, understand ownership and confirm what was completed and verified. Learn more about healthcare compliance reporting and verification. 

The Bottom Line 

The lesson from the OIG audit isn’t that automated edits, manual reviews or provider education are ineffective. The lesson is that no individual control should be evaluated in isolation. 

A system audit needs a reliable review process. A review needs an owner. An owner needs a deadline. A completed action needs verification. The entire response needs documentation that the organization can retrieve when challenged. 

Healthcare compliance programs have matured, and expectations have increased with them. It’s no longer enough to show that a policy was written, an alert was generated, or an email was sent. 

Organizations increasingly need to prove that risks were identified, evaluated, assigned, addressed and verified. 

That’s the difference between having compliance controls and operating a defensible compliance process. 

Can Your Documentation Prove the Work? 

Take the Compliance Documentation Readiness Check to evaluate whether your current process can demonstrate ownership, action, evidence and verification. 

The assessment takes approximately three to four minutes and provides a personalized result with access to the Prove-It Compliance Playbook. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post When Regulatory Compliance Controls Exist but Still Fail  first appeared on YouCompli.

Healthcare compliance teams do a lot of work that never fits neatly into a single report.

They monitor regulatory changes. They coordinate with departments. They investigate issues. They respond to concerns. They train staff. They track corrective actions. They prepare updates for leadership. They answer questions from auditors, boards, regulators, and internal stakeholders.

But when someone eventually asks, “Can you prove it?” activity alone is not enough.

Documentation is what connects the work to the proof.

For healthcare compliance leaders, documentation should no longer be treated as an administrative afterthought or a last-minute scramble before a board meeting, audit, or investigation. It should operate as a strategic asset: a defensible system of record that shows what happened, who owned it, what changed, and how the outcome was verified.

That is the core idea behind prove-it compliance.

Why compliance documentation needs to prove more than activity

Good documentation does more than show that a task was completed. It helps compliance leaders answer the questions that matter when internal leadership, board members, state examiners, or federal agencies want to understand how an issue was handled.

A defensible record should help answer:

• How did this issue occur?
• What steps did we take to resolve it?
• What steps did we take to prevent future occurrences?

That level of documentation matters because compliance work is often reviewed after the fact. A concern may start as an internal report, an audit finding, a hotline issue, a privacy incident, a regulatory change, or a billing concern. Later, that same issue may need to be explained to a board committee, a state agency, the Office for Civil Rights, or another oversight body.

In that moment, the organization needs more than memory. It needs objective evidence.

A strong system of record reduces the stress of those moments because the compliance team is not scrambling to recreate the story. The story is already documented.

For teams managing a high volume of regulatory updates, this is also where regulatory change management becomes more than awareness. The work needs to move from “we saw the regulation” to “we reviewed it, assigned it, acted on it, verified it, and can show the record.”

Who needs compliance proof?

Different audiences need different levels of documentation.

Compliance leadership needs to see the work. That means granular data on intake, analysis, implementation status, ownership, follow-up, and completion across departments. This helps show whether the compliance function can manage high volumes of change and issue resolution.

Boards and compliance committees need to see the value. They usually do not need every log entry or operational detail. They need high-level summaries, trends, dashboards, and Problem-Solution-Proof narratives that show how compliance protects the organization.

Federal and state government reviewers need to see the process. They may need documentation that tracks a regulation, issue, or requirement from initial notice to final operational proof. This is where defensibility matters most.

A strong system of record should support all three audiences without forcing the compliance team to rebuild the story each time. That is also why healthcare compliance reporting should do more than summarize activity. It should help teams monitor risk, track ownership, and show what has been reviewed, assigned, completed, and verified.

The problem with scattered documentation

Most healthcare compliance leaders already understand that documentation is important. The challenge is usually not awareness. It is execution.

Documentation gaps often happen because compliance work is reactive. Fire drills, urgent requests, audits, investigations, and unexpected issues interrupt routine logging. Teams may also struggle with unclear ownership. If nobody knows who is responsible for documenting the who, what, when, and outcome, records become inconsistent or incomplete.

Another common challenge is the optimism trap. Teams may underestimate how long education, monitoring, corrective action, and documentation will actually take. A timeline that looks reasonable in April may become unrealistic by June if staffing changes, operational demands, or competing priorities interfere.

Resource scarcity creates another barrier. When teams rely on spreadsheets, shared drives, emails, personal folders, or disconnected tracking systems, documentation becomes harder to maintain and harder to retrieve.

The result is a familiar pattern: compliance teams do the work, but the proof is scattered.

That same issue shows up in broader regulatory change management. As YouCompli has covered in From Manual to Scalable: How to Manage Healthcare Compliance Risk, the pace and complexity of healthcare regulatory change can become a risk of its own when teams do not have systems that help them manage it.

What a defensible system of record should include

A true system of record is more than a folder on a drive.

It should function as a single source of truth for compliance documentation. That means the organization can find the right records, verify who did what and when, understand which version of a requirement or policy was used, and show how the work connects to oversight expectations.

At minimum, a defensible system of record should support:

• Retrievability: Can the team find a specific record from three years ago in under ten minutes?
• Version control: Is everyone working from the current version of the requirement, policy, or process?
• Audit readiness: Can the team move from searching for proof to presenting proof?
• Workflow accountability: Is it clear who owned each step and when action was taken?
• Documentation integrity: Can the record show objective evidence, not just a subjective summary?

This is especially important when documentation needs to support regulatory obligations, board reporting, state audit readiness, False Claims Act concerns, privacy investigations, billing issues, or corrective action follow-through.

For teams thinking through the structure of their compliance program, YouCompli’s article on how the OIG’s General Compliance Program Guidance addresses the Seven Elements is a useful related read.

How to structure compliance documentation for defensibility

It is not just what the team documents. It is how the documentation is structured.

To stand up to external scrutiny, documentation should go beyond a simple “yes” or “no.” It should create a clear trail that another person can understand later, even if the original owner has moved roles or left the organization.

A few practical standards help.

Every record should include audit-ready details such as date, time, owner, approver, relevant metadata, and objective evidence. If a policy change connects to training, monitoring, or corrective action, those related records should be cross-referenced. The documentation should tell the whole story from issue identification to resolution.

Compliance teams should also avoid subjective conclusions that are not supported by facts. A strong record should focus on what was observed, what requirement or regulation was cited, what decision was made, what action was taken, and what evidence supports the outcome.

One useful test is the ten-minute rule: can a specific record be retrieved and explained in under ten minutes?

If not, the documentation may exist, but it may not be defensible in a practical sense.

For more on how audit readiness requires a proactive posture, see YouCompli’s article, With Compliance Audits, The Best Defense is a Good Offense.

The operational toolkit behind prove-it compliance

Once the system of record exists, compliance teams need the daily tools that keep it useful.

A few core logs and plans often create the backbone of defensible documentation:

Compliance work plan: Shows planned initiatives, resource allocation, and progress against organizational and departmental goals.

Audit and monitoring plans: Show systematic checking, proactive issue detection, and corrective action follow-through.

Education and training plan: Shows what training was provided, who attended, and what expectations were communicated to impacted workforce members.

Investigation and disclosure log: Shows how issues were identified, investigated, resolved, and disclosed to regulators when appropriate.

The key is to make documentation a natural byproduct of the workflow, not an extra task that happens weeks later from memory.

For example, an investigation log should be updated at each stage of an inquiry. Waiting until the end increases the risk that context, decisions, and details will be lost.

Moving from activity reporting to impact reporting

Once a system of record is working well, compliance leaders can do more than prove that activity happened. They can show outcomes and value.

That requires moving from activity metrics to impact metrics.

Instead of reporting only how many tasks were completed, compliance teams can show whether the compliance engine is reliable, whether risk is being reduced, and whether compliance is embedded into daily operations.

Examples include:

Operational health: Timeliness of regulatory intake and task completion rates. This helps prove reliability by showing that the compliance process is consistent and predictable.

Risk reduction: Trends in identified gaps, audit findings, and closure rates. This helps prove protection by showing that the program is finding and fixing issues before they become bigger liabilities.

Engagement and culture: Training completion, hotline volume, policy acknowledgement, and advisory requests. This helps prove culture by showing that compliance is integrated into the daily work of the organization.

This is also where the Problem-Solution-Proof model becomes useful.

For more on reporting compliance value, see Healthcare Compliance KPIs: Real-Time Data Dashboards and YouCompli’s Healthcare Compliance Reporting and Verification page.

Using the Problem-Solution-Proof framework

Board and senior leadership reporting should not be a long list of compliance activities. It should tell a clear story.

The Problem-Solution-Proof framework helps compliance leaders frame that story:

Problem: What specific regulatory challenge, operational risk, issue, or gap required action?

Solution: What did the organization do in response?

Proof: What objective evidence shows that the action was completed and had the intended effect?

For example:

Problem: New state-level False Claims Act requirements.

Solution: Implemented a new verification workflow and staff training.

Proof: 100% training completion and zero documentation gaps found in an internal audit.

This kind of reporting helps leadership see not just what compliance did, but what changed because of the work.

How mature documentation helps compliance evolve

A mature system of record does more than store documentation. It helps compliance leaders spot trends.

If one department consistently misses documentation deadlines, that is not just a tracking issue. It is a roadmap for targeted improvement. If a recurring policy issue keeps appearing, the problem may not be staff effort. It may be that the policy is confusing, difficult to apply, or not supported by enough training.

By documenting and reviewing these patterns, compliance teams can move from reactive oversight to proactive leadership.

That is the shift from documentation as storage to documentation as intelligence.

When technology becomes necessary

Manual habits are often the starting point for compliance documentation. But as regulatory change volume grows, manual systems can become difficult to maintain.

Spreadsheets, shared folders, inboxes, and disconnected tracking systems may work for a small number of issues. But they often create problems when teams need consistent workflows, objective evidence, assignment tracking, audit trails, reporting, and centralized retrieval.

When evaluating software to support regulatory change management documentation, compliance teams should look for capabilities that:

• Act as a centralized repository
• Automate audit trails
• Reduce time and resource burdens through workflow automation
• Show who did what and when
• Preserve documentation integrity
• Support defensibility for state audits, False Claims Act concerns, and federal oversight
• Function as more than a filing system

The goal is not simply to digitize documentation. The goal is to make the compliance program more accountable, searchable, reportable, and defensible.

For a deeper software evaluation framework, see What to Look for in Regulatory Change Management Software for Healthcare Compliance. You can also review How YouCompli Works to see how regulatory change can move through a repeatable process: know what changed, decide what matters, manage the work, and verify completion.

The prove-it moment

Effective documentation is more than a regulatory requirement. It is the bridge between compliance activity and organizational safety.

When documentation is scattered, compliance teams are forced to reconstruct the proof later. When documentation is structured, searchable, and tied to workflow, the organization is better prepared for board reporting, audits, investigations, and leadership conversations.

That preparation matters when the prove-it moment arrives.

The strongest compliance documentation does not just show that work happened. It shows that the organization took the issue seriously, assigned ownership, acted on the requirement, verified the outcome, and preserved the proof.

That is the difference between activity and defensibility.

Want to see how your documentation process holds up?

Take the Prove-It Compliance Readiness Check to evaluate whether your current process supports retrievability, accountability, defensibility, and leadership-ready reporting.

Take the Readiness Check

You can also download the full Prove-It Compliance Playbook for a more detailed framework on building a defensible system of record for healthcare compliance documentation.

The post How Healthcare Compliance Teams Can Turn Documentation Into Defensible Proof first appeared on YouCompli.

About the Medical Necessity Series 

This is the third in our series of articles on medical necessity. In the first, we described the compliance risks associated with submission of claims for medically unnecessary services.   

In the second, we highlighted a case where an organization of long-term care hospitals were alleged to have violated the Federal False Claims Act (FCA) for holding patients in the hospital longer than medically necessary to increase reimbursement from Medicare. 

In this next article, we spotlight another recent example of a healthcare provider entity agreeing to pay a six-figure sum to resolve allegations of submission of claims for medically unnecessary services¹.  This time, the providers consisted of three affiliated skilled nursing facilities (SNF) that were alleged to have submitted claims for medically unnecessary rehabilitation services.   

False Claims Act Metrics Make Significance Clear 

The Department of Justice has reported that False Claims Act settlements and judgments reached $6.8 billion in Fiscal Year 2025. Over $5.7 billion of that total was derived entirely from the healthcare sector. Most of these healthcare recoveries stem from whistleblower lawsuits targeting corporate billing schemes, upcoding, and medically unnecessary services. 

Case Involves SNF Reimbursement Dispute Over Therapy Services 

For the period in question, skilled nursing facilities (SNFs) were reimbursed for therapy services based on a patient’s resource utilization group (RUG). The RUG was determined by the amount of services the patient received, such as: 

•  Physical therapy 
• Occupational therapy  
• Speech pathology services 

In short, the more services provided, the higher the reimbursement.  However, as discussed in our two prior articles, if the services don’t meet medical necessity requirements, they should not have been performed or billed in the first place. 

Whistleblower Lawsuit Triggers Investigation 

As is frequently the case, these allegations were first brought forth through a qui tam, or whistleblower, lawsuit. The whistleblower, or relator, claimed the defendants implemented a five-pronged scheme to fraudulently bill for unnecessary “Ultra High Rehab,” (the most intensive therapy provided by SNFs) and to keep patients in Ultra High Rehab for longer than necessary. 

The five prongs of the alleged scheme were: 

1. Pressure to perform excessive, unnecessary services: The organization’s leadership exerted pressure on therapy staff to administer excessive Ultra High Rehab and to do so for longer than necessary.   

This pressure was exerted not only by administrators who oversaw SNF operations, but also by regional directors of operations who managed the facility administrators. Such pressure was also exerted by directors of rehab (DOR) who managed therapists at each facility, and regional managers who directly managed the DORs.  

In other words, management, from top to bottom, spoke to therapists and staff in one voice: increase Ultra High Rehab, regardless of patient need. 

2. Financial vs. medical reasons to provide care:  Instead of letting therapists determine the appropriate level of therapy needed based on their professional evaluation, leadership insisted that each patient’s level of therapy be at least in part determined by whether the patient qualified for lucrative Medicare Part A benefits. 

3. Care for functional patients: The organizations pressured therapists to continue providing therapy to patients who were fully functional and in no way required intensive therapy. A scheme called “Bridge to Success” was employed which mandated an additional week of Ultra High Rehab be tacked on even after patients were ready for discharge. 

4. Too sick for care: The organizations pressured therapists to provide therapy to patients who were too sick to benefit from therapy and even to patients who were actually harmed by it.  

Since therapy minutes were dictated by management and not assigned based on the professional opinion of evaluating therapists, patients ended up receiving more therapy than they could tolerate, including instances where therapy was forced on patients about to pass away. 

5. Maximizing minutes: The focus on maximizing therapy minutes to hit therapy goals also resulted in leadership encouraging an array of fraudulent billing practices. 

This included: 

• Billing non-therapeutic minutes as therapy  
• Allowing therapists to bill for therapy without actually providing it 
• Encouraging therapists to bill evaluation sessions as therapy. 

Widespread Occurrences Involve $14.6+ Billion in Alleged Intended Losses 

Federal enforcement actions emphasize the commonality of these practices. The 2025 National Health Care Fraud Takedown alone resulted in criminal charges against 324 defendants nationwide, involving over $14.6 billion in alleged intended losses tied to fraudulent billing and medical necessity abuses. 

The most compelling argument for compliance leaders is that medical necessity fraud carries dual liability: 

• Financial Risk: Organizations face mandatory treble damages (three times the government’s actual loss) plus steep statutory penalties for every individual false claim submitted. 
• Human Risk: Unlike administrative billing errors, medical necessity fraud directly compromises patient care. Overutilization exposes vulnerable patients to unnecessary, exhausting or potentially harmful procedures simply to satisfy corporate revenue targets. 

Three Takeaways from Medical Necessity Cases 

Much can be learned from the themes of these allegations, even if your organization isn’t an SNF or doesn’t provide therapy services. Medical necessity requirements are common across most healthcare organizations. 

Key lessons from this case include: 

1. Decisions about billing for medical care provided need to be based on clinical and regulatory requirements, especially coverage requirements from Medicare and Medicaid, for example.   Such requirements often include statutes about: 

• Medicare coverage 
• Medicare manuals 
• National Coverage Determinations  
• Regional Medicare Administrative Contractors’ Local Coverage Determinations (LCD)  

2. Regular, focused compliance coding and billing audits may identify aberrant practices. This is especially true for services whose corresponding medical documentation doesn’t support compliance with coding or billing rules.   
    
   For example, Medicare reimbursement rules state that routine, non-skilled services aren’t separately reimbursable. In this case, it was alleged that one therapy assistant was coached to include in therapy minutes the time it took him to arrive at a patient’s room starting with the moment he left the therapy department. 
    

3. Use data analytics to identify outliers. Most whistleblower cases alleging medically unnecessary services are brought by an individual with knowledge from inside the organization. Many times, the individual is a physician, nurse or other clinician with medical expertise.   
    
   This case was different. It was filed by a private analytics firm using publicly available data. Though rare, these cases do exist. If a private firm using public data could find the alleged aberrations, one would hope the organization’s own compliance professionals would be able to find similar aberrations if given the resources to look.  Additionally, the government is using data analytics to identify cases they want to pursue as well. 

Apply These Takeaways to Your Own Regulatory Compliance Program 

False Claims Act allegations alleging a lack of medical necessity can take many forms. The kind of service or type of provider may also vary, but these key themes appear in many cases. The astute compliance professional will learn from them and apply the principles to the operations and services provided at their own healthcare organization. 

The claims resolved by the settlement are allegations only, and there has been no determination of liability. 

The post Lessons from the Frontlines: A Case Study in Medical Necessity Enforcement  first appeared on YouCompli.

With the release of the CIA changes within the General Compliance Program Guidance (GCPG), the OIG has officially moved the goal posts. This isn’t just a new set of rules for organizations under investigation. 

The May 2026 update to the Corporate Integrity Agreement (CIA) framework signals a definitive shift from passive reporting to active governance. Compliance is no longer an administrative sub-function. It’s now a board-level strategic imperative. 

The OIG’s Modernized CIA: Your New Compliance North Star 

Whether you’re a leader in an acute care organization, or in a non-acute care market like home health, ASCs, labs, or behavioral health, these updates represent your new “North Star.”  

This blog offers a roadmap to navigating the four pillars of this modernized framework. 

• Pillar 1: The Board’s Mandatory Compliance Partner 
• Pillar 2: Catching Every Whisper in the “Any Modality” Net 
• Pillar 3: Technological Accountability and the IT Governance Mandate 
• Pillar 4: The Elevated (and Independent) Compliance Officer 

Pillar 1: The Board’s Mandatory Compliance Partner 

What does the OIG’s mandatory independent board compliance expert requirement mean for healthcare leadership? 

For years, boards could fulfill their oversight duties by simply reviewing a quarterly slide deck. Those days are over. The OIG now requires the appointment of an independent compliance expert with federal healthcare program experience to review program effectiveness and report findings directly to the board. 

An expert is only as effective as the data they have to work with. To be truly “audit-ready,” your organization needs a living, centralized record of every regulatory change and the specific actions taken in response. Without this “evidence engine,” an independent expert will spend hundreds of billable hours just trying to find the paper trail. That could create a massive financial liability for the board. 

Boards are also now mandated to formally respond to the expert’s findings in their annual reports. You can’t “file and forget” an audit anymore. The OIG is looking for a “culture of inquiry” where board members aren’t just receiving information but actively challenging it. 

Pillar 2: Catching Every Whisper in the “Any Modality” Net 

How has the OIG expanded the definition of a healthcare disclosure program beyond the traditional hotline? 

The OIG has finally caught up with how the modern healthcare workplace actually communicates. A “disclosure” is no longer defined by the phone number it was called into. Now it’s defined as any report made through any modality. 

The reality is, in a busy lab or ASC, a compliance concern rarely starts with a formal hotline call. It starts with an email to a supervisor, a quick Teams message between nurses, or an “off-the-cuff” comment in a hallway or breakroom. 

The Roadmap Action: If a billing concern is raised in a Microsoft Teams thread but never makes it into your formal compliance log, you are in violation of the new standards. 

• Modality Audit: You must ensure your intake log captures: 
• Digital Channels: Email, Slack, Microsoft Teams, Zoom chat, and other messaging platforms. 
• Interpersonal Channels: In-person “walk-ins” and verbal reports made to management or HR. 
• The Log Requirement: Every report, regardless of how it is received, must be tracked with its nature, status, and corrective action taken. 

Pillar 3: Technological Accountability and the IT Governance Mandate 

What are the specific OIG reporting requirements for Generative AI and Information Technology in the 2026 CIA framework? 

In perhaps the most significant update to the compliance landscape in decades, the OIG is mandating technological accountability. IT has gone from support service to a governance partner. 

Set a Place for the Mandatory IT Seat at the Table 

The modernized CIA framework requires that the Compliance Committee formally include IT expertise. The OIG recognizes that in a digital-first environment, governance is impossible without an understanding of the underlying infrastructure, data flows, and automated systems. 

The Roadmap Action: Organizations should update their Compliance Committee Charters to include a CTO, CISO, or equivalent technical lead. This individual is responsible for bridging the gap between regulatory mandates and digital execution.

Defining and Inventorying Generative AI as a Requirement 

The OIG has introduced a formal, rigorous definition of Generative AI for reporting purposes. The new definition focuses on foundation models and systems that “generate new content or inferred outputs” used in clinical, billing, or administrative decision-making. 

Your Generative AI Inventory must track: 

1. Life Cycle Use Cases: Identifying where AI is deployed, such as automated utilization reviews, draft patient communications, clinical note summarization, or coding/billing reconciliation. 
2. Deployment Status: Reporting whether a tool is in the “Pilot,” “Pre-deployment,” or “Production” phase. 
3. Data Provenance and Security: Documenting how Protected Health Information (PHI) is shielded from being used as training data for public or foundation models. 

The Risk of “Shadow AI” 

The OIG is particularly focused on “Shadow AI”, meaning automated tools implemented by individual departments without the Compliance Committee’s knowledge. Under the new reporting mandates, a marketing team using an AI bot to answer patient queries or a billing department using a third-party “coding assistant” without formal approval is now a reportable risk. 

By mandating these inventories, the OIG is forcing a shift from “trust” to “verification.” Compliance committees must document their review and approval of any AI tool before it impacts federal healthcare program billing or patient care. This creates a mandatory “accountability trail” that proves the organization is managing AI risks, such as algorithmic bias and “hallucinated” clinical data. 

Pillar 4: The Elevated (and Independent) Compliance Officer 

How is the OIG changing the independence and stature of the Compliance Officer role? 

The OIG is giving the Compliance Officer (CO) role real “teeth.” The new framework explicitly states that the CO must report directly to the CEO and cannot be subordinate to the General Counsel or the CFO. 

This change is about removing conflicts of interest. Legal and Finance have their own mandates, and Compliance must be free to evaluate them both. 

The Roadmap Action: 

• Direct Board Access: The CO must have direct, unfiltered access to the board. 
• Executive Sessions: Mandatory quarterly meetings with the board, including at least one portion in “executive session” without other senior management present. 
• Board Supervision: The board is now responsible for the supervision and performance evaluation of the CO, further decoupling the role from the CEO’s sole influence. 

Conclusion: Your Proactive CIA Readiness Checklist: Four Tactical Steps 

The OIG isn’t about making the job harder. They’re making it more technical and more transparent. To align with these modernized expectations before a regulatory knock at the door, prioritize these four tactical steps: 

1. Appoint an IT Lead to Compliance: Update your charter to include a technical expert who can oversee your AI and data governance. 
2. Conduct an AI Audit: Identify where automated tools are being used. Document what tools are being used, for what purpose, and how the data is being protected. 
3. Centralize Your “Any Modality” Intake: Move away from fragmented email folders. You need a single source of truth that can export a defensible log of every hallway conversation and digital message. 
4. Adopt the Gold Standard Early: Treat these new CIA mandates as a “Pre-Settlement Readiness Review.” Adopting these standards now proves to the OIG that your organization is committed to a culture of integrity, not just the appearance of one. 

Need some help putting together your “evidence engine” and a proactive CIA strategy? YouCompli takes acute and non-acute care organizations from chaos to compliance confidence. Reach out with your questions and challenges. 

Blog Glossary 

• General Compliance Program Guidance (GCPG): The OIG’s definitive framework for healthcare compliance.  
• Active Governance: A model where leadership and the board are directly involved in compliance effectiveness, moving beyond “check-the-box” reporting to formal responses and resource allocation. 
• Corporate Integrity Agreements (CIA): Binding five-year contract between healthcare entity and the HHS Office of Inspector General (OIG), imposed as part of a civil settlement to resolve allegations of fraud or abuse. 
• Shadow AI: The unauthorized or undocumented use of artificial intelligence tools within an organization without the review or approval of the Compliance Committee or IT leadership. 
• Generative AI: A category of technology utilizing foundation models to generate new content or inferred outputs used in clinical, administrative, or billing decision-making. 

Six More Resources 

Four Ways to Engage Leaders in a Culture of Compliance – Building positive, proactive relationships with leaders is crucial to a culture of compliance. Learn four approaches to engage leaders. 

10 Tips for Building a Compliance Culture in Healthcare – The tips explore how you can convince leaders that a strong compliance culture adds value to the organization. 

What to Look for in Regulatory Change Management Software for Healthcare Compliance – A modern regulatory change management (RCM) system does more than just notify you when regulatory changes occur. Learn what’s really possible today and why it matters. 

Your Board Committee Is Only as Effective as You Make It – Ten ways to engage your healthcare compliance board committee. 

How to Use AI for Systems Thinking in Compliance Processes – Artificial intelligence is beginning to reshape the compliance landscape, but the field is still in the early stages of adoption. 

Experts Weigh In: The Oversight Role of a Healthcare Board of Directors – Whether new to the field or a seasoned professional, get ideas on how support your board’s oversight responsibility for the compliance program. 

About the Author 

Jerry Shafran is the founder and CEO of YouCompli with years of experience in the healthcare compliance space.

He is a serial entrepreneur who builds on a solid foundation of information technology and network solutions. Jerry launches, manages and sells software and content solutions that simplify complex work. His innovations help compliance professionals focus on their core priorities.  

AI Handbook for Compliance Pro’s

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Schedule a quick overview

The post OIG Compliance North Star: Roadmap to the 2026 Modernized CIA Framework  first appeared on YouCompli.

Ensuring medical necessity for services or supplies isn’t just about getting paid. It’s a safeguard against unnecessary or duplicative services that increase the risk of patient harm or medical errors. That’s reason enough for this to be an important topic for compliance leaders. 

This is the first article in a series on medical necessity — an area that many compliance programs struggle with. In this piece, we explain the medical necessity compliance risk in general, while subsequent articles highlight specific examples of enforcement actions experienced by medical providers such as hospitals and health systems. 

Impact of Denial Rates and Medical Necessity on Payer Costs  

Data suggests that medical necessity is becoming a primary way for payers to manage costs, making it even more worthy of leadership attention. The “State of Claims 2025” Report found that 54% of providers agree claim denials are increasing faster than they can appeal. 

A data accuracy gap also contributes to the problem. Roughly 41% of healthcare organizations report at least 1 in 10 claims is denied, often due to “bad data” at intake or lack of clinical justification. 

All of this creates further justification for the need to better understand medical necessity from a compliance standpoint. 

Role of Clinician Review in Determining Medical Necessity 

Medical necessity isn’t an easy compliance risk to tackle, especially when OIG recommendations bump up against front-line reality. Sometimes, clinicians view medical necessity as their bailiwick.   

Of course, their expertise is the basis for medical decision making. Generally speaking, clinicians are making their decisions based on what they believe is medically necessary. They are the clinically trained professionals and should know when something is medically necessary or not, right?  

However, from a compliance standpoint, medical necessity often really means “covered” by a third-party payor. If something is considered “not medically necessary,” it may actually mean it does not meet payor coverage requirements. 

OIG on Clinical Review of Medical Necessity in Claims Audits 

In their General Compliance Program Guidance document (GCPG), the Department of Health and Human Services (HHS) Office of Inspector General (OIG) emphasized the importance of ensuring claims submitted to government payors are medically necessary. 

Specifically, they note:  

“Medicare requires, as a condition of payment, that items and services be medically reasonable and necessary. Therefore, entities should ensure that any claims reviews and audits include a review of the medical necessity of the item or service by an appropriately credentialed clinician. Entities that do not include clinical review of medical necessity in their claims audits may fail to identify important compliance concerns relating to medical necessity.” 

Considerations for Compliance Risks in NCD and LCD 

Other entities have also emphasized medical necessity as coverage criteria. For example, Medicare publishes National Coverage Determinations (NCDs) and Local Coverage Determinations (LCDs). These are, in essence, coverage criteria for a specific service.  

Though generally accepted medical guidelines or medical practice may suggest a certain treatment plan is appropriate, the LCD might not cover the service for a particular condition or diagnosis or might not allow the service at a particular cadence or frequency. 

Example: Meeting LCDs for Pain Injection Procedures 

LCDs addressing pain injection procedures are a good example of this. A Medicare LCD might state that before Medicare considers a spinal injection “medically necessary” (think “covered”), the patient needs to have failed four months of conservative therapy (e.g., lifestyle changes, physical therapy, etc.)   

Or the LCD might state a total of four injections in a twelve-month period is the maximum number of injections they will allow. Additionally, an LCD might require that a patient has a certain condition (represented by an ICD-10 or diagnosis code i.e., diagnosis code) before considering a service covered.   

There is potential compliance risk in all these areas if coverage criteria are not met and documented in the medical record or if codes are reported to ensure coverage, but the medical record does not support the diagnosis code reported. 

Overlap with Patient Safety 

Medical necessity can also overlap with patient safety issues. If a physician exaggerates the severity of a condition to make it look like the services should be covered, a patient could undergo a procedure that was not appropriate or medically necessary to perform in the first place.  

This raises patient safety issues for subjecting a patient to certain risks when the service does not appropriately meet clinical standards or indications for performance. 

How Medical Necessity Compliance Is Enforced 

The government utilizes various tools for enforcing medical necessity compliance.  These include the False Claims Act (FCA), typically used by the U.S. Department of Justice (DOJ), and the Civil Monetary Penalties Law (CMPL) utilized by the OIG. 

The DOJ can investigate allegations of medically unnecessary services when credible information is brought to its attention by whistleblowers (qui tam relators). A qui tam relator is a private individual or entity who files a lawsuit on behalf of the government under the FCA against companies or individuals committing fraud. Or the DOJ can investigate on their own, typically because of data analytics they proactively perform. 

How OIG Pursues Financial Penalties and Program Exclusion 

The OIG is authorized to pursue monetary penalties and exclusion through a variety of civil authorities, most notably the CMPL. Under the CMPL, OIG can seek assessments in lieu of damages, Civil Monetary Penalties (CMP), and exclusion from participation in federal health care programs.   

According to the OIG, one example of conduct that could lead to CMP liability is presenting a claim for a pattern of medical or other items or services that a person knows or should know are not medically necessary. 

Medical Necessity Risk Tied to Clinical Services 

There isn’t a one-size-fits-all risk profile when it comes to medical necessity. Each organization’s risk is going to be tied to the clinical services it offers or orders. Organizations and their compliance programs should undertake risk assessments tailored to their particular situation.  

Via the GCPG document, the OIG recommends that when conducting risk assessments, organizations should “ensure that medical necessity, patient safety, and other quality compliance issues are included in the risk universe.” 

Download Tip Sheet

Coming Articles: Details of Recent Enforcement Actions 

In subsequent articles in this series, we’ll take a closer look at the details of recent enforcement actions involving allegations that submitted claims lacked medical necessity. This information will help compliance leaders stay on top of situations and reduce risks in their own organizations.  

Read Part Two Here

About the Author 

CJ Wolf, MD, M.Ed. is a healthcare compliance professional with over 27 years of experience in healthcare economics, revenue cycle, coding, billing, and healthcare compliance. He has worked for Intermountain Healthcare, the University of Texas MD Anderson Cancer Center, the University of Texas System, an international medical device company and a healthcare compliance software start up. Currently, Dr. Wolf teaches and provides private healthcare compliance and coding consulting services as well as training.   

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Medical Necessity: A Guide for Healthcare Compliance Leaders  first appeared on YouCompli.

For years healthcare leaders have been faced with demonstrating their value and answering the question, “How is compliance doing?” Getting the answers typically involves a scattered, manual process of pulling data from multiple sources, departments, and teams, then going through the process of aggregating that data to pull important, need-to-know information. By the time that step is complete, often the information is already out of date. 

Compliance Confidence with Real-Time Data. Now You Have Answers. 

We knew there was a better way, and who better to partner with than our existing clients? With our expertise and their input, we developed the new YouCompli Analytics Dashboard, now a standard tool within YouCompli Software for all clients.  

This blog explains what the YouCompli Analytics Dashboard is and how it helps compliance leaders demonstrate the immense value they bring to an organization through their ability to monitor and oversee regulatory work in real time. 

Problem: Accessing Important Compliance Metrics and Data 

Compliance leaders need to monitor and oversee regulatory work throughout the organization, and that can be very challenging. Many organizations lack the time and resources to quickly access regulatory information that may be scattered across an organization and then roll it up into a reportable and actionable result. 

The Solution: Real-Time Metrics and Transparency 

The YouCompli Analytics Dashboard takes regulatory changes and immediately provides you with information on key performance indicators (KPIs) when it comes to compliance. These KPIs are simple to access.  

Just identify the date range of information you want to review and let YouCompli take it from there. You’ll be provided with real-time, on-demand information on all the need-to-know metrics when it comes to implementing and complying with new and updated regulations.  

Task Status: Summary of current task status (e.g., accepted, assigned, in progress, completed) of task due dates within the selected date range. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Instead of pulling multiple reports in YouCompli to filter, sort, and manipulate to showcase the regulatory work, now by entering a date range, we’ll do all the hard work for you.  

• Want to know how long it takes you to comply with new regulatory requirements? YouCompli will tell you!  
• Want to know exactly what hasn’t been done yet? See the total amount and then click the number to have the list of overdue requirements at that moment.  
• Doing great? See your overall requirement and task completion rates immediately on how your organization is doing from 0% – 100% to get right to the work that needs to get done or celebrate your accomplishments for a job well done.  

Benchmark data, set goals, and have real-time information to measure improvements against previous performance. 

YouCompli Analytics Dashboard = Operational Accountability 

The YouCompli Analytics Dashboard brings transparency to all departments to evaluate where compliance activities are timely and complete. It also allows you to identify gaps in regulatory oversight and accountability and ensures you’re able to quickly address them. 

Open Requirements by Department: Breaks down open requirements within the selected effective date range and displays the percentage attributed to each department. 

Requirement Status: Summary of current status (e.g., accepted, assigned, in progress, completed) of requirements effective during the selected date range. 

The YouCompli Analytics Dashboard brings to light regulatory compliance activities and how the work is distributed across an organization. It gives insight into: 

The value of regulatory change management software. 

• How many regulations did our organization review? 
• How many regulatory changes have we completed? 
• How many regulatory changes have yet to be done, and … 
• Does this pose potential risk of penalties, fines, investigations or reputation? 
• How are we doing overall? 

YouCompli Analytics Dashboard = Everything You Need to Know 

Nothing comes close to the YouCompli Analytics Dashboard when it comes to quickly and easily monitoring and overseeing the state of regulatory compliance. Whether you’re looking for high-level information for boards and senior leadership teams or more detailed information for compliance committee or department-level teams, the YouCompli Analytics Dashboard provides all the need-to-know information.  

Requirement Completion Rate: Percentage of requirements effective within the selected date range that have been completed. 

Task Completion Rate: Percentage of tasks completed for requirements effective within the selected date range.  

YouCompli Analytics Dashboard Overview 

The YouCompli Analytics Dashboard provides your organization with the following information: 

• Requirement and Task Completion Rates 
• Average Number of Days to Complete Regulatory Requirements and Tasks 
• Requirements Completed with Missing Important Information (Relevance) 
• Total Requirements and Tasks Overdue  
• Total Volume of Regulatory Requirements Published/Assigned in YouCompli  
• List of All Requirements and Tasks Completed 
• Regulatory Requirement and Task Status (Assigned, Accepted, In Progress and Completed  
• Regulatory Requirement Heat Map: Top 5 Departments with Overdue Regulatory Requirements 
• Open Regulatory Requirements Across All Departments 
• Software Utilization Monitoring (Software User Activity and Requirement Completions) 

Example: Values link to detailed reports showing all contributing data. 

What the Data Means: 

Average Days to Requirement Completion: Average number of days between requirement published date and requirement completion date for requirements effective within selected date range.   

Average Dates to Task Completion: Average number of days between the task assigned date and the task completion date for tasks associated with requirements effective during the selected date range.   

Total Requirements Completed, Relevance Unknown: Total number of requirements completed within the selected date range, but relevance status was not answered.  

Total Requirements Overdue: The total count of incomplete requirements past their effective date within the selected timeframe.  

Total Tasks Overdue: Total number of tasks not completed and past their due date within the selected date range. 

YouCompli Analytics Dashboard Demonstrates Your Compliance Value 

The YouCompli Analytics Dashboard is standard part of the YouCompli software and is just one of the ways our client success team works for clients every day. We take feedback and opportunities to continuously improve for the valued clients we serve every day. Want to learn more? Let’s start a conversation. 

About the Author 

Amy Laufmann, MBA, Client Success Manager at YouCompli, has 10+ years of experience in healthcare compliance leadership and operations in the Pacific Northwest and is passionate about helping healthcare organizations demonstrate the immense value compliance teams provide the healthcare organizations they serve. In her current role, she works with clients to ensure they get the most value out of the YouCompli software and supports compliance leaders nationwide to continuously improve the services and support YouCompli provides. 

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Healthcare Compliance KPIs: Real-Time Data Dashboards  first appeared on YouCompli.

For healthcare compliance leaders, financial literacy is not optional. Compliance risk often hides in the fine print of financial data, making literacy a prerequisite for effective oversight.  

To identify anomalies or potential regulatory “red flags,” compliance officers must move beyond a high-level view of healthcare finance and understand how clinical operations translate into financial entries. 

What does a compliance leader need to understand? Things like: 

• Budgeting and capital planning 
• Internal controls and risk 
• Grant and research compliance  
• Key performance indicators (KPIs) 
• Communication between CFO and compliance officer 

Familiarity with the 14 steps of the revenue cycle is also valuable for mitigating risks associated with reimbursements and 340B compliance. (This topic is covered later in the blog.) 

Where Do Healthcare Compliance and Finance Intersect? 

Regulatory compliance and healthcare finance overlap in multiple ways. Compliance-related areas with a financial angle include: 

• Medicare, Medicaid reimbursement 
• 340B drug pricing 
• Stark Law and anti-kickback statutes 
• Charity care 
• Financial assistance requirements  

What Should Compliance Leaders Understand About Financial Statements? 

To build fiscal literacy, let’s start with some foundational concepts – financial statements. Compliance officers should have a basic understanding of these types of statements: 

1. Balance Sheet 
2. Income Statement 
3. Cash Flow Statement 

1. The Balance Sheet: Assessing Financial Integrity Through a “Snapshot” 

The balance sheet provides a snapshot of an organization’s financial health at a specific point in time, detailing its assets, liabilities and equity. 

Why Compliance Should Care: Monitoring the balance sheet helps ensure that assets are properly recorded, and that liabilities like these are appropriately disclosed: 

• Potential legal settlements 
• Debt obligations 
• Medicare overpayments 

2. The Income Statement: Monitoring Operational Risk Over Time 

Unlike the balance sheet snapshot, the income statement tracks revenue and expenses over a specific period, such as a month or a fiscal year. The income statement puts a focus on total revenue and expenses, and the difference between them, while distinguishing between operating and non-operating items. Those two concepts are compared in the chart below. 

In an income statement, it’s important to distinguish between accrual-basis accounting (matching revenue to period it was earned) and cash-basis accounting (recording transactions only when money changes hands). 

Why Compliance Should Care: By comparing current monthly performance against previous years, compliance officers can spot outliers in revenue or sudden spikes in expenses that could indicate billing errors, “upcoding,” or improper financial arrangements under the Stark Law. 

3. The Cash Flow Statement: Ensuring Operational Sustainability 

The cash flow statement tracks the actual movement of cash into and out of the organization, categorized by: 

• Operating activities 
• Investing activities 
• Financing activities 

Why Compliance Should Care: Understanding cash flow is vital for making sure the organization has liquidity to maintain compliance standards even during times of financial strain. A significant discrepancy between reported net income and actual cash flow can signal deep-seated issues with revenue cycle integrity.  

Revenue Cycle as Regulatory Roadmap 

For a prepared healthcare compliance leader, the revenue cycle isn’t just a financial process; it’s a regulatory roadmap. From initial patient interaction to final collection, each step presents a unique set of compliance risks that can lead to audits, fines or loss of reimbursement if not managed with understanding. 

What Compliance “Trapdoors” to Watch for in the Revenue Cycle 

The revenue cycle is full of complexity, largely fueled by the impact of different hospital types (PPS, critical access, disproportionate share, and tribal hospitals) on Medicare and Medicaid rates. 

While the full revenue cycle has 14 distinct stages, compliance officers should pay particular attention to these “trapdoors” where financial operations must meet strict federal regulations: 

• Front-End Integrity (Scheduling and Registration): Accuracy is paramount to ensure Medicare and Medicaid reimbursements aren’t jeopardized by incorrect patient data or lack of prior authorization. 
• Clinical Documentation and Coding: This is a high-density risk area. Compliance must make sure that coding reflects the actual services provided to avoid allegations of “upcoding” or “unbundling,” which can trigger False Claims Act investigations. 
• 340B Drug Pricing Program: If an organization participates in 340B, the revenue cycle needs rigorous internal audits to establish compliance with drug diversion and duplicate discount prohibitions. The stakes will be even higher if the program undergoes potential changes regarding payment models. 
• Billing and Claims Submission: Errors in this stage directly impact the Clean Claim Rate. More importantly, consistent billing errors for federal healthcare programs can lead to significant liability under Anti-Kickback Statutes or the Stark Law if improper financial relationships are found. 

Monitoring Denial Management at Back End of Revenue Cycle 

A robust compliance program monitors the back end of the revenue cycle as closely as the front. Analyzing denials can reveal systemic issues in documentation or billing practices that, if left unaddressed, represent both financial loss and compliance vulnerability. 

What KPIs Should Compliance Watch as Part of Financial Oversight? 

For a healthcare compliance officer, financial data is more than just a reporting requirement. It’s a proactive tool for risk assessment. By monitoring specific KPIs, compliance teams can move from reactive auditing to strategic oversight and identify operational stressors before they escalate into violations. 

The “Big Four” Financial KPIs for Compliance Officers 

Comprehensive financial oversight should track these four metrics: 

• Operating Margin: This measures whether the organization’s core clinical mission is profitable after all operating and overhead costs are paid. A shrinking margin often leads to “cutting corners” in staffing or documentation, which directly increases compliance risk. 
• Days Cash on Hand: This indicates liquidity. How many days can an organization operate using its current cash reserves if all revenue stopped? Higher liquidity provides the financial “breathing room” to maintain compliance and quality standards even during economic downturns. 
• Clean Claim Rate (CCR): A high CCR (ideally 95% or higher) indicates that claims are being submitted without errors the first time. A low rate is a red flag for systemic billing or documentation errors that could trigger federal audits under the False Claims Act. 
• Payer Mix: It’s critical to understand the percentage of revenue coming from Medicare, Medicaid and private insurance. In many healthcare models, Medicare functions as a “break-even” payer, while Medicaid reimbursements often fall below the actual cost of care, placing additional pressure on revenue integrity. 

What to Know about Budgeting and Internal Controls 

Compliance officers should also distinguish between the Operating Budget (daily/annual clinical operations) and the Capital Budget (typically reserved for long-term investments or items over $10,000). 

To prevent fraud and ensure financial integrity, a compliance program must enforce strict segregation of duties. This assures that no single individual has control over all aspects of a financial transaction, serving as a primary defense against embezzlement and improper financial reporting. 

Using the SBAR Tool to Structure CFO and Compliance Communication 

The most effective healthcare compliance programs are those where the Chief Compliance Officer (CCO) and Chief Financial Officer (CFO) operate as strategic partners.  

However, communicating complex compliance risks in a way that aligns with financial priorities requires a structured approach. This is where the SBAR tool (Situation, Background, Assessment, Recommendation) becomes invaluable for justifying financial decisions and resource allocation. (Download a helpful SBAR template at the end of this article)

Four-Step Method for Financial Advocacy 

Use this four-step method to present compliance needs to your finance team: 

• Situation: Clearly state the immediate financial or regulatory issue.  
  Example: “We have identified a 15% discrepancy in our 340B drug pricing audits.” 

• Background: Provide the necessary context and data.  
  Example: Current Medicare reimbursement rates for these drugs are subject to strict transparency requirements. 
   
• Assessment: Offer your professional analysis of the risk.  
  Example: Failure to rectify this documentation gap poses a significant risk to operating margin and regulatory standing and could trigger a federal audit. 
   
• Recommendation: Propose a specific, data-backed solution.  
  Example: “I recommend an immediate investment in automated tracking software as part of the next capital budget cycle.” 

How Compliance Can Secure a “Seat at the Table” 

By confidently speaking the language of finance with terms like liquidity, capital planning and debt financing, compliance officers move beyond being seen as a “cost center” and the “Department of No.”  

Instead, compliance can become a guardian of the organization’s financial sustainability, ensuring that compliance is integrated into every high-level discussion, from annual budgeting to long-term strategic growth.  

Ready to drive more compliance value? Reach out to see how YouCompli can help.  

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

The post Financial Literacy: The “Superpower” Every Modern Compliance Leader Needs  first appeared on YouCompli.